| CVE-2026-32773 |
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to…
|
Non notée
|
2 sept. 2026 |
| CVE-2025-54920 |
This issue affects Apache Spark: before 3.5.7 and 4.0.1
|
Non notée
|
14 mars 2026 |
| CVE-2025-55039 |
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0
|
Non notée
|
15 oct. 2025 |
| CVE-2024-23945 |
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its…
|
Non notée
|
23 déc. 2024 |
| CVE-2023-32007 |
** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option…
|
Non notée
|
2 mai 2023 |
| CVE-2023-22946 |
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as,…
|
6.4
Moyenne
|
17 avr. 2023 |
| CVE-2022-31777 |
A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote…
|
Non notée
|
1 nov. 2022 |
| CVE-2022-33891 |
Exploitée
Apache Spark Command Injection Vulnerability
|
Non notée
|
18 juil. 2022 |
| CVE-2021-38296 |
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and…
|
Non notée
|
10 mars 2022 |
| CVE-2020-9480 |
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication…
|
Non notée
|
23 juin 2020 |
| CVE-2018-11760 |
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the…
|
Non notée
|
4 févr. 2019 |
| CVE-2018-17190 |
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then…
|
Non notée
|
19 nov. 2018 |
| CVE-2018-11804 |
Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to…
|
Non notée
|
24 oct. 2018 |
| CVE-2018-11770 |
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the…
|
Non notée
|
13 août 2018 |
| CVE-2018-8024 |
In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL…
|
Non notée
|
12 juil. 2018 |
| CVE-2018-1334 |
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different…
|
Non notée
|
12 juil. 2018 |